MS-102 Practice Test 20 — 15 Questions

Question 1

Your company uses Microsoft 365 Business Premium. You need to ensure that all company-owned Windows 10 devices are automatically enrolled in Microsoft Intune when users sign in with their work account. The devices are Azure AD joined. You have configured automatic enrollment in Intune. However, some devices are not enrolling. You need to troubleshoot the issue. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that each user has an appropriate Microsoft Intune license assigned.. Automatic enrollment in Microsoft Intune requires each user to have an appropriate Intune license (e.g., Microsoft 365 Business Premium includes Intune). Without a license, the device will not be able to enroll even if all other prerequisites are met. The license is checked during the enrollment process, and if missing, enrollment fails silently.

Answer

Ensure that devices are Azure AD joined and not domain joined.

Answer

Check the Windows 10 version; version 1607 or later is required.

Answer

Check that the MDM authority is set to Microsoft Intune in Microsoft Entra ID.

Question 2

A security administrator wants to simulate a realistic phishing attack to train users and measure their susceptibility. The simulation should be run from within Microsoft Defender XDR and provide detailed reporting. Which feature should the administrator use?

Accepted Answer

Attack Simulation Training. Attack Simulation Training in Microsoft Defender XDR allows security administrators to create and launch realistic phishing campaigns directly from the Microsoft 365 Defender portal. It provides detailed reporting on user interactions, such as who clicked the link or entered credentials, enabling measurement of user susceptibility and targeted training follow-ups.

Answer

Advanced Hunting

Answer

Automated Investigation and Response

Answer

Threat Analytics

Question 3

A company has a Microsoft 365 E5 tenant with 10,000 users. You need to delegate the ability to manage Microsoft Entra ID roles to a group of support engineers. The solution must follow the principle of least privilege and allow engineers to assign only specific roles to users. What should you do?

Accepted Answer

Create a custom role in Microsoft Entra ID with permissions to assign specific roles, and use PIM to enable just-in-time access. It follows the principle of least privilege by creating a custom role that grants only the specific permissions needed to assign designated roles, and using Privileged Identity Management (PIM) for just-in-time (JIT) access ensures engineers are elevated only when required. This approach avoids granting standing administrative privileges and allows granular control over which roles can be assigned, meeting the requirement to delegate role management without over-provisioning.

Answer

Assign the engineers the Privileged Role Administrator role

Answer

Add the engineers to the Global Administrator role in Microsoft Entra ID

Answer

Create a group in Microsoft Entra ID and assign it the User Administrator role, then use PIM to elevate

Question 4

You run the above PowerShell command on a Windows 10 device that is onboarded to Microsoft Defender for Endpoint. The device is reporting as healthy in the portal, but you suspect that some behavioral detection capabilities are turned off. Based on the output, which setting should you modify?

Accepted Answer

Set DisableBehaviorMonitoring to False to enable behavior monitoring.. The PowerShell command output shows that DisableBehaviorMonitoring is set to True, which disables behavioral monitoring. Since the device is healthy but behavioral detection capabilities are suspected to be off, setting DisableBehaviorMonitoring to False re-enables behavior monitoring, allowing Defender for Endpoint to analyze runtime behavior for threats.

Answer

Enable cloud-delivered protection by setting MAPSReporting to Advanced.

Answer

Set DisableBlockAtFirstSeen to True to enable Block at First Sight.

Answer

Set DisableRealtimeMonitoring to True to enable real-time monitoring.

Question 5

You are planning a migration from on-premises Active Directory to Microsoft Entra ID using cloud sync. You need to synchronize user passwords so that users can authenticate using their existing passwords. Which feature should you enable?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct feature because it synchronizes the hash of a user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password without any additional on-premises infrastructure. Cloud sync specifically relies on PHS to replicate password hashes from AD to Entra ID, enabling seamless authentication for cloud-based services.

Answer

Pass-through Authentication

Answer

Federation with AD FS

Answer

Seamless Single Sign-On

Question 6

Refer to the exhibit. You deploy this configuration profile to Windows devices. What is the most likely outcome?

Accepted Answer

Automated investigation will be triggered for alerts with severity Medium and above, and email notifications will be sent to admin@contoso.com.. The configuration profile sets the automated investigation action to 'Medium or higher' and specifies a single email recipient (admin@contoso.com). This means Defender for Endpoint will trigger automated investigations for alerts with severity Medium, High, or Critical, and send email notifications only to the listed address, not to all admins.

Answer

Automated investigation will be triggered only for alerts with severity High, and email notifications will be sent to all admins.

Answer

Automated investigation will be disabled, and email notifications will be sent to admin@contoso.com.

Answer

Automated investigation will be triggered for all alerts regardless of severity, and no email notifications will be sent.

Question 7

A company wants to require approval for any activation of the Global Administrator role in Privileged Identity Management (PIM). The approvers are predefined as members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify to meet these requirements?

Accepted Answer

Edit the role settings of the Global Administrator role in PIM.. The requirement to require approval, enforce a business justification, and set a 4-hour expiration for Global Administrator activations is configured in the role settings of the Global Administrator role within Privileged Identity Management (PIM). These settings control activation parameters such as approval requirements, justification, and maximum activation duration, which directly map to the stated needs.

Answer

Create an access review for the Global Administrator role.

Answer

Configure Azure AD Identity Protection to require MFA for Global Administrator.

Answer

Assign the Global Administrator role directly to the users temporarily.

Question 8

Your organization uses Microsoft Entra ID and has a hybrid identity setup with password hash synchronization. You need to ensure that when a user's on-premises Active Directory account is disabled, their Microsoft Entra ID account is also disabled within 30 minutes. What should you do?

Accepted Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute and set the sync frequency to 30 minutes.. Disabling an on-premises Active Directory account sets the 'userAccountControl' attribute (specifically the ACCOUNTDISABLE flag, bit 2). By configuring Microsoft Entra Connect to sync this attribute and setting the sync frequency to 30 minutes, the disabled state is replicated to Microsoft Entra ID within that interval, ensuring the cloud account is also disabled.

Answer

Enable Azure AD Connect cloud sync.

Answer

Configure password hash synchronization to run every 30 minutes.

Answer

Enable password writeback.

Question 9

Your organization uses Microsoft Entra ID and has an application that requires the 'User.Read.All' permission. You need to grant this permission to the application but ensure that only an administrator can consent, not users. What should you do?

Accepted Answer

Grant admin consent for the application from the Enterprise applications blade.. Granting admin consent from the Enterprise applications blade explicitly authorizes the application to access the 'User.Read.All' permission without requiring individual user consent. This is the only way to satisfy the requirement that only an administrator can consent, as admin consent bypasses user consent policies entirely and applies tenant-wide.

Answer

Enable user consent for this application in the enterprise application settings.

Answer

Configure the user consent settings to allow user consent for low-risk permissions.

Answer

Set the 'Consent and permissions' settings to block user consent.

Question 10

Your organization needs to create a custom domain in Microsoft 365. You have added the domain 'contoso.com' to the tenant. What is the next step to verify domain ownership?

Accepted Answer

Add a TXT record to the public DNS zone.. After adding a custom domain to a Microsoft 365 tenant, the next mandatory step is to prove ownership of the domain by adding a specific TXT record provided by Microsoft to the domain's public DNS zone. Microsoft queries this TXT record to verify that you control the domain before allowing you to use it for services like email or user accounts. This verification step is required by Microsoft's domain onboarding process and must succeed before any other configuration can proceed.

Answer

Create user accounts with the custom domain.

Answer

Configure the email exchange (MX) record.

Answer

Assign licenses to users with the custom domain.

Question 11

An administrator needs to open a Microsoft 365 support request because all users are experiencing intermittent service outages for Exchange Online. Before contacting support, which two pieces of information should the administrator have ready to ensure efficient troubleshooting? (Choose two.)

Accepted Answer

Tenant ID (or Microsoft 365 tenant domain name). The Tenant ID (or Microsoft 365 tenant domain name) is required by Microsoft Support to uniquely identify your tenant in their systems, enabling them to pull up your service configuration, subscription details, and relevant health data. This identifier is essential for routing the support request to the correct engineering team and for correlating the issue with backend telemetry.

Answer

Number of affected users

Answer

Network bandwidth graph from the past 24 hours

Question 12

Your organization recently deployed Microsoft Defender for Office 365. Users report that some legitimate external emails are being quarantined as phishing attempts. You need to reduce false positives without compromising security. What should you do?

Accepted Answer

Add the sender domains to the allowed senders list in the anti-phishing policy. Adding the sender domains to the allowed senders list in the anti-phishing policy explicitly whitelists those domains for phishing checks, reducing false positives while still scanning for other threats. This approach preserves security by not lowering the overall spam filtering threshold or disabling protections, and it targets only the specific domains that are being incorrectly flagged.

Answer

Increase the Spam Confidence Level (SCL) threshold to 9

Answer

Disable the anti-phishing policy and use a custom mail flow rule

Answer

Change the spam filtering action to 'Move message to Junk Email folder' instead of quarantine

Question 13

A company wants to implement just-in-time (JIT) privileged access for the Security Administrator role. Users must be able to activate the role with a business justification, and the activation must be approved by a designated group of approvers. The role activation should expire after 4 hours. Which Privileged Identity Management (PIM) configuration should the administrator modify?

Accepted Answer

Role settings for the Security Administrator role. To configure just-in-time (JIT) privileged access with approval, expiration, and justification requirements, you must modify the Role settings for the Security Administrator role in Privileged Identity Management (PIM). Role settings control activation parameters such as maximum activation duration (4 hours), whether approval is required, and whether justification is mandatory. This is the only place where these activation policies are defined.

Answer

Assignments (Eligible) for the Security Administrator role

Answer

Assignments (Active) for the Security Administrator role

Answer

Notifications settings under PIM

Question 14

You are examining the default cross-tenant access policy for your Microsoft Entra ID tenant. Based on the exhibit, which statement is true?

Accepted Answer

External users must always reauthenticate even if their home tenant requires MFA.. The default cross-tenant access policy in Microsoft Entra ID includes a setting that, when enabled, requires external users to satisfy MFA requirements from their home tenant. However, the exhibit shows that the 'Trust MFA from external tenants' option is not selected, meaning Entra ID will not accept MFA claims from the external user's home tenant. As a result, external users must always reauthenticate with MFA, even if their home tenant already enforced MFA.

Answer

Your users can use their Microsoft Authenticator app to sign in to partner tenants.

Answer

B2B direct connect is enabled for all external organizations.

Answer

Compliant device claims from external tenants are trusted.

Question 15

You are a Microsoft 365 administrator. Your tenant has a Microsoft Entra ID P2 license. You need to create a dynamic group for all users whose department is 'Engineering' and who are located in the United States. Which rule syntax should you use?

Accepted Answer

user.department -eq "Engineering" and user.country -eq "United States". Dynamic group rules in Microsoft Entra ID require the use of lowercase 'and' as the logical operator, and the country attribute value must match the display name 'United States' as stored in the directory. The rule syntax must follow the property -operator 'value' format exactly, with no capitalization of 'and'.

Answer

user.department -eq "Engineering" and user.country -eq "US"

Answer

user.department -eq "Engineering" And user.country -eq "United States"

Answer

user.department -eq "Engineering" AND user.country -eq "United States"